CVE-2016-8749

Name of the Vulnerable Software and Affected Versions Apache Camel versions prior to 2.16.5 Apache Camel versions prior to 2.17.5 Apache Camel versions prior to 2.18.2

Description The issue concerns a Java object de-serialization vulnerability in Apache Camel's Jackson and JacksonXML unmarshalling operations, which can lead to Remote Code Execution attacks. De-serializing untrusted data can result in security flaws, as seen in similar Java de-serialization issues.

Recommendations For versions prior to 2.16.5, upgrade to 2.16.5. For versions prior to 2.17.5, upgrade to 2.17.5. For versions prior to 2.18.2, upgrade to 2.18.2. As a temporary workaround, consider restricting the use of the CamelJacksonUnmarshalType property to minimize the risk of exploitation.